oz0 tenant oidc publish
For: Operators and developers looking up a command.
For a cluster whose edges the internet cannot reach: the edges' public address (--public-edge-url) names a web server or bucket the clouds can reach, and this copies the tenant's discovery document and key set there, under the issuer's path (oidc/<tenant>/.well-known/openid-configuration and oidc/<tenant>/jwks.json). --to is a folder a web server serves, or s3://bucket[/prefix][?region=R&endpoint=URL] with credentials from the AWS_* variables or --credentials-file, never the command line.
The key set holds the next key ahead of a rotation; publish again after every rotation, before the next one, and at once after an emergency rotation, whose new key is in no published set. Nothing is sent anywhere until you run this.
Usage
oz0 tenant oidc publish <tenant> --to <folder | s3://bucket/prefix> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--credentials-file | string | the AWS_* variables | an AWS shared credentials file for an s3:// target |
--dry-run | bool | check the documents and say where they would go, without writing | |
--from | string | the CLI context's edge API | the edge to read the documents from, https://<edge>:<port> |
--to | string | a folder a web server serves, or s3://bucket[/prefix][?region=R&endpoint=URL&path-style=true] |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.